Enea, a company specializing in telecommunications software and cybersecurity, has revealed the activity of a new threat group called SilentAir, which operates at the level of "state-level actors." This group employs sophisticated techniques to compromise mobile network operator nodes, allowing it to intercept calls and text messages directly from within the network infrastructure.
Attack Mechanism and Techniques Used
SilentAir relies in its operations on launching signaling attacks, specifically via the SS7 protocol, and sometimes via the Diameter protocol. By gaining control over network nodes at telecommunications operators, the group redirects incoming calls and text messages for targets through the compromised nodes, which allows it to:
- Intercept Data: Collect subscriber details and communication content.
- Location Tracking: Monitor the geographical locations of targets (although this represents a small part of its activity).
- Silent SMS: Send silent text messages (Silent SMS) that do not appear on the user's phone, which are believed to be used to confirm the success of previous interception operations or to verify device status.
Geographic Scope and Targets
According to the Enea report, Taiwan is the primary target for these attacks. However, compromised nodes have been detected in at least six Asian countries, and the group's activities have extended to include countries in East Africa, Central Asia, the Middle East, and Europe. The list of targets has included high-level political and government figures.
Enea suggests, with "low confidence," that SilentAir's activities are linked to Chinese operations, based on the intensive focus on Taiwan, the absence of Chinese targets from the attacks, and the synchronization of attack timing with working hours in the China time zone.
What Does This Threat Change?
The danger of SilentAir lies in the fact that it does not target smartphones directly via traditional malware, but rather targets the "backbone" of communications. This type of attack makes it very difficult for the average user or even device security systems to detect espionage, because the interception process takes place at the network infrastructure layer before the signal reaches the phone.
Potential Links to the Liminal Panda Group
The report also pointed to the activity of another group called Liminal Panda, which Enea observed exploiting the IP exchange (IPX) network used by telecommunications operators to exchange traffic. A backdoor known as GTPDoor associated with this group was discovered, with hundreds of attempts to connect to command and control servers being detected. Although there is no conclusive evidence, Enea points to the possibility of a link between SilentAir and Liminal Panda.